.NET 10 reference
Secure a .NET API
A .NET integration should establish application identity, canonicalize and sign outbound requests, validate inbound trust at the edge, reject replay, authorize the action and resource, propagate a protected execution context, and emit evidence.
Working components
Implementation steps
Register one B5 application identity per deployable API client or service.
Load the signing secret from an approved secret store and keep key ID separate from secret material.
Canonicalize method, request target, timestamp, nonce, content digest, audience, and selected headers.
Sign using the assigned test algorithm and transmit the key ID, timestamp, nonce, digest, and signature.
At the receiving edge, validate key state, algorithm, lifetime, audience, canonical form, signature, and replay atomically.
Authorize action plus resource, then emit correlation and evidence identifiers.
Sign the request before it reaches business logic
B5RequestSigner usage
var signed = B5RequestSigner.Sign(
HttpMethod.Post,
new Uri($"{baseUrl}/v1/trust/decisions"),
body,
tenantId,
applicationId,
keyId,
secret,
DateTimeOffset.UtcNow);
request.Headers.Add("X-B5-Timestamp", signed.Timestamp);
request.Headers.Add("X-B5-Nonce", signed.Nonce);
request.Headers.Add("X-B5-Content-SHA256", signed.ContentSha256);
request.Headers.Authorization =
new AuthenticationHeaderValue("B5-HMAC-SHA256", signed.SignatureBase64);C#.NET 10 quick startSDK-style .NET 10 project.Download ↓C#Request signerCanonical HMAC-SHA-256 request signing.Download ↓C#First protected callRunnable console client.Download ↓C#Webhook verifierFreshness and constant-time signature verification.Download ↓
Production requirement: put secret material in an approved secret store or HSM-backed provider. Keep the public key identifier in configuration, and test rotation overlap, expiry, revocation, replay-store continuity, proxy canonicalization, and clock skew.
Developer Relations
Talk to a human.
Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.